An identity authentication and authorization method and system

Abstract

This invention provides an identity authentication and authorization method and system, relating to the field of information management security technology. The method includes: receiving an identity authentication request initiated by a user and determining the category of the identity authentication request, wherein the request category includes: anonymous authentication request and real-name authentication request; when the identity authentication request is anonymous authentication, performing anonymous authentication on the user through an RSA accumulator to determine an anonymously authorized user; authorizing the anonymously authorized user to access public resources; when the identity authentication request is real-name authentication, performing real-name authentication on the user through two-factor authentication and biometric authentication to determine a real-name authorized user; generating a search credential based on the user credentials of the real-name authorized user; performing an encrypted search based on the search credential, and sending the found encrypted file to the real-name authorized user. This invention significantly improves the security and privacy protection capabilities of identity authentication.

Description

Technical Field

[0001] This invention relates to the field of information management security technology, and in particular to an identity authentication and authorization method and system. Background Technology

[0002] Identity authentication and authorization methods are core mechanisms in the field of information security, used to verify the identity of users or systems and assign corresponding access permissions after identity verification. Identity authentication emphasizes "who you are," confirming the legitimacy of the subject through passwords, biometrics, digital certificates, etc.; while authorization emphasizes "what you can do," determining the scope of the subject's access to resources and operations.

[0003] With the development of the Internet, the openness and complexity of systems and data are constantly increasing. Enterprises and individuals have higher requirements for convenience, needing high security without sacrificing user experience excessively. Therefore, building an identity authentication and authorization method that combines security, flexibility and scalability is an inevitable choice to ensure data and system security.

[0004] However, existing identity authentication schemes typically employ a uniform authentication process, lacking differentiated handling for anonymous and real-name access. This makes it difficult to strike a balance between protecting user privacy and identity security, and also fails to effectively prevent unauthorized users from exceeding their authority in sensitive operations. During the authentication process, existing schemes only verify usernames and passwords, making them vulnerable to theft, credential stuffing, or brute-force attacks, resulting in insufficient security for identity authentication. Summary of the Invention

[0005] In view of the shortcomings of the prior art, the purpose of this invention is to provide an identity authentication and authorization method that can solve the problems of existing identity authentication schemes, which usually adopt a unified authentication process and lack differentiated processing for anonymous access and real-name access. This makes it difficult to achieve a balance between protecting user privacy and identity security, and it cannot effectively prevent unauthorized users from exceeding their authority in sensitive operations. In the authentication process, existing schemes only verify the username and password, which is vulnerable to theft, credential stuffing, or brute-force attacks, resulting in insufficient security of identity authentication.

[0006] A first aspect of this invention provides an identity authentication and authorization method, comprising:

[0007] S1: Receive an identity authentication request initiated by a user and determine the category of the identity authentication request, wherein the request category includes: anonymous authentication request and real-name authentication request;

[0008] S2: When the identity authentication request is the anonymous authentication request, proceed to step S3; when the identity authentication request is the real-name authentication request, proceed to step S5.

[0009] S3: Perform anonymous authentication on the user using an RSA accumulator to determine the anonymously authorized user;

[0010] S4: Authorize the anonymous authorized user to access public resources;

[0011] S5: Perform real-name authentication on the user through two-factor authentication and biometric authentication to determine the real-name authorized user;

[0012] S6: Generate a search credential based on the user credentials of the real-name authorized user;

[0013] S7: Perform an encrypted search based on the search credentials and send the found encrypted files to the real-name authorized user.

[0014] A second aspect of this invention provides an identity authentication and authorization system, comprising: a processor and a memory;

[0015] The memory stores programs or instructions that can run on the processor, which, when executed by the processor, implement the steps of the authentication and authorization method as described in the first aspect.

[0016] A third aspect of the present invention provides a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the authentication and authorization method as described in the first aspect.

[0017] The beneficial effects of the technical solutions provided in the embodiments of the present invention include at least the following:

[0018] In this embodiment of the invention, a classification mechanism for authentication requests enables tiered processing of anonymous and real-name authentication, balancing privacy protection with high security requirements. By generating zero-knowledge proofs, users can complete anonymous authentication without revealing their true identity, enhancing privacy and anti-forgery capabilities. Two-factor authentication and biometric authentication enhance security against man-in-the-middle attacks, replay attacks, and credential leakage, avoiding privacy risks. By generating search credentials, user credentials are bound to encrypted queries, achieving an organic combination of authentication and search, ensuring that only legitimate real-name users can initiate searches. Encrypted search and result return ensure that query keywords remain in ciphertext, preventing the leakage of search intent and significantly improving the security and privacy protection capabilities of identity authentication. Attached Figure Description

[0019] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts. Obviously, the drawings described below are merely some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings without any creative effort.

[0020] Figure 1 This is a flowchart illustrating an identity authentication and authorization method provided in an embodiment of the present invention.

[0021] Figure 2 This is a schematic diagram of the structure of an identity authentication and authorization system provided in an embodiment of the present invention. Detailed Implementation

[0022] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. It should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0023] The identity authentication and authorization method provided by the embodiments of the present invention will be described in detail below with reference to the accompanying drawings, through specific embodiments and application scenarios.

[0024] Reference manual attached Figure 1 The diagram shows a flowchart of an identity authentication and authorization method provided by an embodiment of the present invention.

[0025] This invention provides an identity authentication and authorization method, which may include the following steps:

[0026] S1: Receive the authentication request initiated by the user and determine the request category, which includes: anonymous authentication request and real-name authentication request.

[0027] It should be noted that classifying identity authentication requests allows for the selection of appropriate authentication methods based on different use cases, thus separating anonymous and real-name authentication. This not only avoids the conflict between security and user experience under a unified authentication model but also enhances the flexibility and relevance of the authentication system, ensuring a balance between protecting privacy and ensuring security.

[0028] S2: If the authentication request is an anonymous authentication request, proceed to step S3. If the authentication request is a real-name authentication request, proceed to step S5.

[0029] Specifically, routing authentication requests to anonymous or real-name authentication paths can avoid the drawbacks of using the same processing method for different security needs, and achieve orderly and differentiated authentication processes. This ensures both efficient and convenient access to public resources and security and compliance of access to sensitive data.

[0030] S3: Use an RSA accumulator to perform anonymous authentication on users and determine anonymously authorized users.

[0031] RSA accumulators are cryptographic tools based on the RSA problem, which can efficiently accumulate multiple elements into a single value and allow users to prove that their elements belong to the accumulated set through witness values ​​and zero-knowledge proofs, without exposing the elements themselves. Anonymous authentication refers to the process by which a user proves to a verifier that they belong to a set of authorized users without revealing their true identity information, using cryptographic mechanisms.

[0032] It should be noted that by using RSA accumulators to achieve anonymous authentication, users only need to provide zero-knowledge proofs to complete identity verification without exposing their real personal information. This effectively improves user privacy protection and the credibility of the authentication process while ensuring authentication security and anti-counterfeiting capabilities.

[0033] In one possible implementation, S3 specifically includes:

[0034] S301: Receive user zero-knowledge proofs generated by the RSA accumulator through the authentication platform.

[0035] Among them, user zero-knowledge proof refers to a proof generated by a user based on the authorized elements and witness values ​​in the RSA accumulator, which is used to prove that the user belongs to the authorized set without revealing their true identity.

[0036] Specifically, by receiving zero-knowledge proofs from users, the authentication platform can complete the verification without knowing the user's real identity information, which greatly reduces the risk of sensitive data exposure and provides trusted input for subsequent verification steps, ensuring both security and privacy in the authentication process.

[0037] In one possible implementation, S301 specifically includes:

[0038] S3011: Initialize the RSA accumulator.

[0039] S3012: Generate user authorization element value using a hash function based on the user's identity information.

[0040] A hash function is a one-way function that maps an input of arbitrary length to an output of fixed length, possessing irreversibility and collision resistance. The user authorization element is a unique representation of the user's identity information obtained through a hash function, used to identify the user in the RSA accumulator without revealing the original information.

[0041] Specifically, generating authorization elements by hashing user identity information can prevent users' real identities from directly participating in the authentication process, ensuring the uniqueness and tamper-proof nature of user identifiers while effectively improving the privacy protection and security of the identity authentication process.

[0042] S3013: Add the user-authorized element value to the RSA accumulator and update the RSA accumulator.

[0043] Specifically, adding user authorization elements to the RSA accumulator and updating the accumulated value can efficiently incorporate new users while maintaining the integrity of the overall set, enabling the authentication system to have dynamic scalability and sustainability, and ensuring that all authorized users can be uniformly managed and verified through the accumulator, thereby improving the system's flexibility and security.

[0044] S3014: Calculate the witness value of the element using the updated accumulator:

[0045]

[0046] in, w i Indicates the first i The witness value of the element corresponding to the authorization element of each user. a t Indicates the accumulator is in t The value at time, X This represents the set of elements contained in the accumulator. x i Indicates the first i The authorization element for each user, where mod represents the modulo operator. n Represents the RSA modulus. g This represents the generator element of the RSA accumulator. In addition to x i The product of all elements, x j Indicates the first j Authorization elements for individual users.

[0047] Specifically, by using the updated accumulator to calculate the witness value of elements, it is possible to generate independent and verifiable mathematical credentials for each user, enabling users to prove their legitimacy without exposing their real identity in subsequent authentication, thereby achieving efficient verification, enhancing anti-counterfeiting capabilities, and improving the overall privacy protection level of the system.

[0048] S3015: Generate a zero-knowledge proof for the user based on the user-authorized element value and the element witness value.

[0049] Specifically, by generating zero-knowledge proofs based on user-authorized elements and element witness values ​​and sending them to the authentication platform, trusted proofs can be completed without disclosing the user's real identity information. This ensures the security and correctness of the authentication process while effectively improving user privacy protection and the reliability of authentication interactions.

[0050] S3016: The authentication platform accepts zero-knowledge proofs from users:

[0051]

[0052] in, z This indicates a commitment to the authorized elements. g and h Both represent the generator elements of the RSA accumulator. ρ x Indicates authorization element x i The corresponding random mask, A g This indicates a commitment to the stochastic index. k Represents the stochastic index. ρ k Represents the stochastic index k The corresponding random mask, A w This indicates that the random index is... k Bind to witness base witness value w i The promise on l Indicates by The generated prime number challenge that binds all commitments. This represents the hash-to-prime function. c Indicates by H The challenges generated by ( ) H ( ) represents a standard hash function. q x Indicates the merchant associated with the authorized element. r x Represents the remainder related to the authorized element. q ρ Representation and random mask ρ Related businesses, r ρ Representation and random mask ρ The relevant remainder, Q g Indicated by the merchant q x and q ρConstructed commitment Q w Indicated by the merchant q x Constructed commitment π This represents a user's zero-knowledge proof.

[0053] In this embodiment of the invention, an RSA accumulator adds the identity elements (hashd to prime numbers) of all authorized users to a set, and generates a corresponding witness value for each user. During authentication, users do not directly expose their identity elements. Instead, they use the witness value and their own elements to generate a proof through non-interactive zero-knowledge proof, demonstrating that "I possess a valid element in the accumulator." After receiving the proof, the verifier reconstructs the commitment based on the proof parameters and the accumulator value, and checks whether the verification equation holds. If true, it confirms that the user indeed belongs to the authorized set, thus completing the anonymous authentication of authorized users without revealing the user's true identity information throughout the process.

[0054] S302: Reconstruct the commitment value based on the user's zero-knowledge proof:

[0055]

[0056] in, Represents the reconstructed A g , Represents the reconstructed A w .

[0057] It should be noted that reconstructing the commitment value based on the user's zero-knowledge proof enables the authentication platform to complete the verification calculation independently without obtaining the user's real identity, thereby ensuring the objectivity and reliability of the authentication results, while enhancing the system's ability to resist forged proofs and improving the overall security level.

[0058] S303: Based on the reconstructed commitment value, determine whether the verification equation holds. If yes, determine that the user is an anonymous authorized user. Otherwise, determine that the user is an unauthorized user.

[0059] S4: Authorize anonymous users to access public resources.

[0060] S5: Through two-factor authentication and biometric authentication, real-name authentication is performed on users to determine the real-name authorized users.

[0061] Two-factor authentication is an identity verification method that combines two different elements (such as a password and a dynamic token) to enhance account security. Biometric authentication is an authentication method that uses a user's biometric features (such as fingerprints, faces, irises, etc.) to identify the user, and it is unique and non-transferable. A verified user is a user whose identity has been confirmed as genuine and legitimate by the system after passing both two-factor authentication and biometric authentication.

[0062] It should be noted that combining two-factor authentication and biometric authentication for real-name authentication not only effectively resists risks such as credential leakage, forgery, and man-in-the-middle attacks, but also utilizes the uniqueness of biometrics to ensure the reliability of authentication results, thereby significantly improving the security strength and credibility of identity authentication.

[0063] In one possible implementation, S5 specifically includes:

[0064] S501: Receives the username, password and biometric data entered by the user, wherein the biometric data specifically includes: the original image signals of fingerprint, face and iris.

[0065] S502: Perform two-factor authentication on the user based on the username and password.

[0066] In one possible implementation, S502 specifically includes:

[0067] S5021: Use the KNF function to derive the key from the username and password to obtain the derived key.

[0068] Specifically, by using KNF functions to derive keys from usernames and passwords, traditional static credentials can be transformed into dynamically derived keys. This avoids the risk of usernames and passwords being directly exposed during transmission or storage, and enhances the ability to resist theft and brute-force attacks, thereby improving the security and reliability of identity authentication.

[0069] S5022: Determine if the derived key matches the reference derived key of the verification platform. If yes, proceed to step S5023. Otherwise, determine that the user has failed two-factor authentication.

[0070] S5023: Combine the derived key and the timestamp to establish a session key.

[0071] Specifically, combining the derived key with a timestamp to generate a session key can ensure the uniqueness and timeliness of each session key, effectively preventing replay attacks and the risk of long-term key exposure, thereby improving the dynamic security of the authentication process and the protection capabilities of interactions.

[0072] S5024: Generate a digital token based on the session key.

[0073] The digital token is specifically:

[0074]

[0075] in, otp Indicates a digital token. DT 31 indicates dynamic truncation, taking a 31-bit non-negative integer. Represents the XOR symbol, H 1 represents the truncation value of the time and the user-bound path. H 2 represents the cutoff value for counting the disturbance path. LE 16 indicates that the lower 16 bits of the input value are taken as an integer. HMAC This represents a hash function with a key. Access Indicates the session key. D This represents the context digest, i.e., the hash result of the phone number and carrier number. L Indicates the length of the digital token. SHA 256 represents the standard SHA-256 hash. T Represents a timestamp. fluid Indicates the username. cent This represents a trial counter, and [0:8] indicates taking the first 8 bytes. 。

[0076] In this embodiment of the invention, the digital token uses the session key as its core, integrating the timestamp, user identifier, counter, and context information to improve unpredictability. By using dual-path mixing and introducing perturbation terms, it resists collision and replay attacks from a single hash path. The computational load is moderate, making it easy to implement in engineering.

[0077] S5025: Sends digital tokens to users via SMS.

[0078] S5026: Enter the digital token on the login screen and verify the token using a Boolean decision formula.

[0079] Boolean decision formula is a logical judgment method that compares the input token with the system's calculation result to obtain a Boolean value indicating whether the verification was successful or failed.

[0080] Specifically, by entering a digital token on the login screen and performing Boolean verification, a fast and accurate automatic comparison can be achieved, effectively resisting forged tokens and replay attacks, and ensuring the reliability of user authentication results and the security of system access.

[0081] S5027: Determine if the Boolean condition is true. If yes, confirm that the user has passed two-factor authentication. Otherwise, confirm that the user has not passed two-factor authentication.

[0082]

[0083] in, Boolean 2FA Indicates the Boolean decision result. SHA Represents a cryptographic hash function. token in This refers to the digital token entered on the login screen.

[0084] S503: When the user passes two-factor authentication, proceed to step S504. When the user fails two-factor authentication, the user is determined to be unauthorized and access is denied.

[0085] Specifically, traffic triage after two-factor authentication can immediately reject access requests when users fail to pass verification, preventing unauthorized users from continuing into subsequent processes. This effectively blocks the risk of unauthorized login, reduces the possibility of system attacks and data leaks, and improves overall security and protection capabilities.

[0086] S504: Perform biometric authentication on users based on biometric data.

[0087] It should be noted that using users' biometric data for identity authentication can effectively prevent account theft or impersonation by leveraging the naturally unique and non-transferable characteristics of fingerprints, faces, or irises, thereby significantly improving the accuracy, security, and reliability of authentication and user identification.

[0088] In one possible implementation, S504 specifically includes:

[0089] S5041: By using a feature extraction function, features of biometric data are extracted to obtain biometric identity records.

[0090] S5042: Convert biometric records into biometric passwords using a fuzz extractor.

[0091] S5043: Using the KDF function, derive the biometric code to generate a revocable transformation key.

[0092] S5044: Based on the revocable transformation key, perform a revocable transformation on the biometric identity record to generate a protected template.

[0093] S5045: Calculate the similarity between the protected template and the reference template generated during user registration.

[0094] S5046: When the similarity is less than the preset similarity, determine that the user has not passed biometric authentication. When the similarity is greater than the preset similarity, confirm that the user has passed biometric authentication.

[0095] It should be noted that those skilled in the art can set the preset similarity level according to actual needs, and this invention does not limit this.

[0096] S505: When a user passes biometric authentication, the user is confirmed as an authorized user. When a user fails biometric authentication, the user is confirmed as an unauthorized user and access is denied.

[0097] Specifically, by performing feature extraction, fuzzing, key derivation, and revocable transformation on biometric data, not only can the privacy leakage risk caused by directly storing the original biometric template be avoided, but high-precision authentication can also be achieved by comparing the similarity between the protected template and the reference template. Furthermore, the template can be revoked and updated, thus ensuring the security, privacy, and sustainability of biometric authentication.

[0098] S6: Generate search credentials based on the user credentials of the real-name authorized user.

[0099] The search credential is a special ciphertext generated by encrypting user credentials, used to perform encrypted searches without revealing plaintext keywords and identity information.

[0100] It should be noted that converting the credentials of real-name authorized users into search credentials ensures that only legitimately authenticated users can initiate valid encrypted search requests, thereby achieving a deep integration of authentication and access control. This not only prevents unauthorized users from making unauthorized queries, but also improves privacy protection and system security during the retrieval process.

[0101] In one possible implementation, user credentials specifically include: digital tokens and biometric records.

[0102] Digital tokens are dynamically generated one-time passwords (OTPs) based on session keys, timestamps, and context information. They are time-sensitive and unique, used in two-factor authentication to verify user identity and effectively resist replay attacks and forged logins. Biometric records are digital representations of user biometric data such as fingerprints, faces, and irises, typically processed with fuzzy extraction and encryption. They are used to verify user presence and uniqueness during authentication, offering non-transferability and high security.

[0103] S6 specifically includes:

[0104] S601: Encrypt query keywords and biometric records.

[0105] S602: Homomorphically mix the encrypted query keywords and biometric records to obtain the mixed ciphertext.

[0106] Specifically, homomorphic mixing of encrypted query keywords and biometric records generates hybrid ciphertext, enabling data computation and binding without decryption. This effectively prevents the leakage of query intent and identity information, while ensuring the uniqueness and unforgeability of search credentials, thereby enhancing the security and reliability of encrypted searches.

[0107] S603: Encrypt the inverse of the biometric record to obtain the encrypted inverse.

[0108] S604: Combine the mixed ciphertext and the cryptographic inverse to generate the search credential:

[0109]

[0110] in, Tv This refers to Trapdoor, or search credentials. Indicates mixed ciphertext, Represents the cryptographic inverse. c BIR This represents an encrypted biometric record. c s This represents the encrypted keyword. ( ) represents the RSA public-key encryption function. ONE Represents biometric identity records, d s This indicates the keywords used in the user's query.

[0111] Specifically, combining hybrid ciphertext with encrypted inverses to generate search credentials can ensure the encryption of query keywords and identity information while achieving the verifiability and uniqueness of the credentials. This effectively prevents unauthorized users from forging credentials to initiate searches, thereby ensuring the security of the encrypted search process and the accuracy of access control.

[0112] S605: Receive search credentials through the authentication platform.

[0113] S7: Perform an encrypted search based on the search credentials and send the found encrypted files to the real-name authorized user.

[0114] In one possible implementation, S7 specifically includes:

[0115] S701: Based on the search credentials, calculate the encrypted form of the query keywords:

[0116]

[0117] in, v This represents the encrypted form of the query keywords. Enc ( ) represents an encryption function.

[0118] S702: Perform an index search based on the encrypted form of the query keywords.

[0119] S703: Send the found encrypted files to the real-name authorized user.

[0120] It should be noted that using search credentials to perform encrypted searches and returning the results to the real-name authorized user can achieve accurate retrieval while maintaining the encrypted state of keywords and data throughout the process. This effectively prevents the leakage of query intent and sensitive information, thereby ensuring the security, privacy, and compliance of the data access process.

[0121] The beneficial effects of the technical solutions provided in the embodiments of the present invention include at least the following:

[0122] In this embodiment of the invention, a classification mechanism for authentication requests enables tiered processing of anonymous and real-name authentication, balancing privacy protection with high security requirements. By generating zero-knowledge proofs, users can complete anonymous authentication without revealing their true identity, enhancing privacy and anti-forgery capabilities. Two-factor authentication and biometric authentication enhance security against man-in-the-middle attacks, replay attacks, and credential leakage, avoiding privacy risks. By generating search credentials, user credentials are bound to encrypted queries, achieving an organic combination of authentication and search, ensuring that only legitimate real-name users can initiate searches. Encrypted search and result return ensure that query keywords remain in ciphertext, preventing the leakage of search intent and significantly improving the security and privacy protection capabilities of identity authentication.

[0123] Reference manual attached Figure 2 The diagram shows a structural schematic of an identity authentication and authorization system provided by an embodiment of the present invention.

[0124] This invention provides an identity authentication and authorization system 20, including: a processor 201 and a memory 202;

[0125] The memory 202 stores programs or instructions that can run on the processor 201. When the program or instructions are executed by the processor 201, they implement the steps of the above-described identity authentication and authorization method and achieve the same technical effect. To avoid repetition, the present invention will not elaborate further.

[0126] It should be understood that the processor 201 in this embodiment of the invention may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0127] It should also be understood that the memory 202 in the embodiments of the present invention can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus RAM (DR RAM).

[0128] The above embodiments can be implemented, in whole or in part, by software, hardware (such as circuits), firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0129] It should be understood that, in various embodiments of the present invention, the order of the above-mentioned process numbers does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0130] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0131] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the devices, apparatuses, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0132] In the several embodiments provided by this invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0133] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0134] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0135] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0136] This invention provides a readable storage medium comprising: storing a program or instructions on the readable storage medium, wherein when the program or instructions are executed by a processor, the program or instructions implement the steps of the above-described identity authentication and authorization method and achieve the same technical effect. To avoid repetition, this invention will not elaborate further.

[0137] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the protection scope of the present invention.

Claims

1. An identity authentication authorization method, characterized by, The method comprises the following steps: S1: receiving a user-initiated identity authentication request and determining the request category of the identity authentication request, wherein the request category comprises an anonymous authentication request and a real-name authentication request; S2: when the identity authentication request is the anonymous authentication request, step S3 is entered; when the identity authentication request is the real-name authentication request, step S5 is entered; S3: performing anonymous authentication on the user through an RSA accumulator to determine an anonymous authorized user; S4: authorizing the anonymous authorized user to access public resources; S5: performing real-name authentication on the user through two-factor authentication and biometric authentication to determine a real-name authorized user; S6: generating a search credential according to a user credential of the real-name authorized user; Wherein the user credential specifically comprises a digital token and a biological identity record; The S6 specifically comprises: S601: encrypting the query keyword and the biological identity record; S602: homomorphically mixing the encrypted query keyword and the biological identity record to obtain a mixed ciphertext; S603: encrypting the inverse element of the biological identity record to obtain an encrypted inverse element; S604: combining the mixed ciphertext and the encrypted inverse element to generate the search credential; S605: receiving the search credential through an authentication platform; S7: performing encrypted search according to the search credential and sending the searched encrypted file to the real-name authorized user; Wherein the S7 specifically comprises: S701: calculating the ciphertext form of the query keyword according to the search credential; S702: performing index search according to the ciphertext form of the query keyword; S703: sending the searched encrypted file to the real-name authorized user.

2. The identity authentication authorization method of claim 1, wherein, The S3 specifically comprises: S301: receiving a user zero-knowledge proof generated by the RSA accumulator through an authentication platform; S302: reconstructing a commitment value according to the user zero-knowledge proof; S303: determining whether a verification equation is established according to the reconstructed commitment value; if yes, determining that the user is the anonymous authorized user; otherwise, determining that the user is an unauthorized user.

3. The identity authentication authorization method of claim 2, wherein, The S301 specifically comprises: S3011: initializing the RSA accumulator; S3012: generating a user authorization element value through a hash function according to the identity information of the user; S3013: adding the user authorization element value to the RSA accumulator to update the RSA accumulator; S3014: calculating an element witness value through the updated accumulator; S3015: generating the user zero-knowledge proof according to the user authorization element value and the element witness value; S3016: receiving the user zero-knowledge proof through the authentication platform.

4. The identity authentication authorization method of claim 1, wherein, The S5 specifically comprises: S501: receiving a username, a password and biometric data input by the user, wherein the biometric data specifically comprises original image signals of fingerprints, faces and irises; S502: performing two-factor authentication on the user according to the username and the password; S503: When the user passes the two-factor authentication, proceed to step S504; when the user fails the two-factor authentication, determine that the user is an unauthorized user, and deny access of the unauthorized user; S504: Perform biometric authentication on the user according to the biometric data; S505: When the user passes the biometric authentication, determine that the user is the real-name authorized user; when the user fails the biometric authentication, determine that the user is a real-name unauthorized user, and deny access of the real-name unauthorized user.

5. The identity authentication authorization method of claim 4, wherein, The S502 specifically comprises: S5021: Derive a key from the username and the password through a KNF function to obtain a derived key; S5022: Determine whether the derived key is consistent with a reference derived key of a verification platform; if yes, proceed to step S5023; otherwise, determine that the user fails the two-factor authentication; S5023: Establish a session key in combination with the derived key and a timestamp; S5024: Generate a digital token according to the session key and the timestamp; S5025: Send the digital token to the user through a short message; S5026: Input the digital token on a login interface, and perform token verification through a Boolean determination formula; S5027: Determine whether the Boolean determination formula is established; if yes, determine that the user passes the two-factor authentication; otherwise, determine that the user fails the two-factor authentication.

6. The identity authentication authorization method of claim 4, wherein, The S504 specifically comprises: S5041: Extract features of the biometric data through a feature extraction function to obtain a biometric identity record; S5042: Convert the biometric identity record into a biometric password through a fuzzy extractor; S5043: Derive the biometric password through a KDF function to generate a revocable transformation key; S5044: Perform revocable transformation on the biometric identity record according to the revocable transformation key to generate a protected template; S5045: Calculate a similarity between the protected template and a reference template generated when the user registers; S5046: When the similarity is less than a preset similarity, determine that the user fails the biometric authentication; when the similarity is greater than the preset similarity, determine that the user passes the biometric authentication.

7. An identity authentication authorization system, characterized by, Comprise: a processor and a memory; The memory stores programs or instructions executable on the processor, and the programs or instructions are executed by the processor to implement the steps of the identity authentication authorization method according to any one of claims 1 to 6.

8. A readable storage medium, characterized by, The readable storage medium stores programs or instructions, and the programs or instructions are executed by the processor to implement the steps of the identity authentication authorization method according to any one of claims 1 to 6.

Images